SysmoUSIM-SJS1 » History » Version 9
dexter, 02/16/2017 11:15 AM
| 1 | 4 | {{>toc}} |
|
|---|---|---|---|
| 2 | 1 | ||
| 3 | 4 | h1. sysmoUSIM-SJS1 |
|
| 4 | |||
| 5 | 1 | The sysmoUSIM-SJS1 is programmable and Java capable USIM card. Not all commands are known yet and this page should grow over time. Each card is using a separate ADM1 key and the default configuration is hacker/developer friendly (fields being writable, reduced security for installing applets to have more quick development cycles). |
|
| 6 | 3 | ||
| 7 | Please see [[shadysim.py]] for a tutorial on installing and removing a SIM Toolkit. |
||
| 8 | 1 | ||
| 9 | |||
| 10 | 5 | laforge | h2. User Manual |
| 11 | |||
| 12 | sysmocom provides a user manual at https://www.sysmocom.de/downloads/sysmousim-manual.pdf |
||
| 13 | 1 | ||
| 14 | 9 | dexter | |
| 15 | 6 | laforge | h2. Availability |
| 16 | |||
| 17 | sysoUSIM-SJS1 is available from http://shop.sysmocom.de/ in both 2FF+3FF (micro) and 2FF+4FF (nano) form factors. |
||
| 18 | 1 | ||
| 19 | 9 | dexter | |
| 20 | 4 | h2. Command Reference |
|
| 21 | |||
| 22 | 1 | To understand this reference, it is assumed that you are familiar with basic knowledge on smartcard |
|
| 23 | technologies, such as standard ISO 7816-3/-4 APDUs and GSM TS 11.11. |
||
| 24 | |||
| 25 | The below should be possible to set after authenticating with the ADM1 pin |
||
| 26 | |||
| 27 | |||
| 28 | 4 | h3. Setting the IMSI |
|
| 29 | |||
| 30 | 1 | Use a standard UPDATE BINARY command on EF.IMSI (7F20/6F07) |
|
| 31 | |||
| 32 | |||
| 33 | 4 | h3. Setting the ICCID |
|
| 34 | |||
| 35 | 1 | Use a standard UPDATE BINARY command on EF.ICCID (2FE2) |
|
| 36 | |||
| 37 | |||
| 38 | h3. Setting the Ki |
||
| 39 | 4 | ||
| 40 | 1 | Use a standard UPATE BINARY command on EF.KI (7F20/00FF) |
|
| 41 | |||
| 42 | |||
| 43 | 9 | dexter | h3. Setting the OP/OPC |
| 44 | 1 | ||
| 45 | 9 | dexter | Use a standard UPATE BINARY command on the EF.OPC (7F20/00F7) |
| 46 | 4 | ||
| 47 | 9 | dexter | |_. Offset |_. Size |_. Description | |
| 48 | |0|1| 0x00 for OP, 0x01 for OPc| |
||
| 49 | |1|16|OP or OPc value, depending on byte at offset 0| |
||
| 50 | 1 | ||
| 51 | 4 | ||
| 52 | h3. Setting the Algorithm(s) |
||
| 53 | 2 | ||
| 54 | Use a standard UPDATE BINARY command on EF.AUTH (7FCC/6F00) |
||
| 55 | |||
| 56 | Two bytes, first byte for 2G, second byte for 3G. |
||
| 57 | 1 | ||
| 58 | 7 | laforge | |_. Value |_. Algorithm |_. Supported Mode | |
| 59 | |01|Milenage|2G + 3G| |
||
| 60 | |03|COMP128v1|2G| |
||
| 61 | |04|XOR 2G|2G| |
||
| 62 | |06|COMP128v2|2G| |
||
| 63 | |07|COMP128v3|2G| |
||
| 64 | |08|XOR 3G|3G| |
||
| 65 | 8 | dexter | |
| 66 | |||
| 67 | h3. Setting the Milenage parameters (Ci/Ri) |
||
| 68 | |||
| 69 | Use a standard UPATE BINARY command on EF.MLNGC (7FCC/6F01) |
||
| 70 | |||
| 71 | |_. Offset |_. Size |_. Description | |
||
| 72 | |0|16|C1| |
||
| 73 | |16|16|C2| |
||
| 74 | |32|16|C3| |
||
| 75 | |48|16|C4| |
||
| 76 | |64|16|C5| |
||
| 77 | |80|1|R1| |
||
| 78 | |81|1|R2| |
||
| 79 | |82|1|R3| |
||
| 80 | |83|1|R4| |
||
| 81 | |84|1|R5| |
